search

niceboygithub / AqaraCamera

Aqara Camera G3 integration for Home Assistant
29 stars 6 forks source link

Does it work with firmware: 3.3.2_0001.0004? #9

Closed mversion closed 4 months ago

mversion commented 2 years ago

After following the instructions, I now have telnet access, but in HA I keep getting failed to connect errors.

Firmware the unit shipped with is 3.3.2_0001.0004 and I haven't updated. Do we need to be on the specific firmware versions you list or all is fine as long as we were able to apply the telnet hack?

Also, anyone know how to "upgrade" to a specific firmware version? Say 3.3.2_0019.0004 or 3.3.4_0007.0004 which is in the supported versions notes.

niceboygithub commented 2 years ago

3.3.4_0007.0004 or 3.3.9_0011.0004 are better.

use this command to update fw

fw_manager.sh -u -n [fw_you_loaded.bin]
mversion commented 2 years ago

thanks @niceboygithub any idea where to download those versions? MY google-fu skills are failing me.

superman110 commented 2 years ago

Unable to upgrade. The command seems wrong 1

niceboygithub commented 2 years ago

two possibilities.

  1. your G3 is not CN version. it is EU.
  2. your G3 is old machine, not PVT machine.
superman110 commented 2 years ago

It should not be Euro model . My G3 was purchased from JD flagship store, and the factory firmware is 3.3.2_0001.0004. Prompt in aqara home app that the latest upgraded version is 3.4.1_0003.0004,The reason why the manual upgrade of 3.3.4 failed may be that it is lower than 3.4.1

mversion commented 2 years ago

Are you able to share that .bin file with me @superman110 ?

superman110 commented 2 years ago

@mversion https://github.com/niceboygithub/AqaraCameraHubfw/raw/main/stock/G3/20211216200913_lumi.camera.gwpagl01_AIOT_V3.3.4_0007.0004_20211216_28f9c3.bin

mversion commented 2 years ago

Same error as yours here, @superman110

niceboygithub commented 2 years ago

It should not be Euro model . My G3 was purchased from JD flagship store, and the factory firmware is 3.3.2_0001.0004. Prompt in aqara home app that the latest upgraded version is 3.4.1_0003.0004,The reason why the manual upgrade of 3.3.4 failed may be that it is lower than 3.4.1

My G3 CN is CH-H03 CH-H02. The firmwares are for CH-H03 CH-H02. Can you give me the JD link?

giahuy2201 commented 2 years ago

My G3 also failed to connect in HA. I tried to update the firmware to 3.3.4_0007.0004, but I think it failed midway and is now not connecting to my wifi at all. Can I unbrick it by flashing the firmware with the TX/RX pins inside? Or is there any other way to save it?

Screen Shot 2022-07-18 at 10 53 43 AM

superman110 commented 2 years ago

@niceboygithub

I bought it here https://item.jd.com/100012820409.html

niceboygithub commented 2 years ago

My G3 also failed to connect in HA. I tried to update the firmware to 3.3.4_0007.0004, but I think it failed midway and is now not connecting to my wifi at all. Can I unbrick it by flashing the firmware with the TX/RX pins inside? Or is there any other way to save it?

Screen Shot 2022-07-18 at 10 53 43 AM

@giahuy2201

You use wrong command, "-u", not "-s". The "-s" will switch aiot/miot cloud but Aqara G3 did not support miot mode. Try to factory reset or 10 times press the button then 2 times. I am not sure that does it work. If not, please call Aqara service.

niceboygithub commented 2 years ago

@niceboygithub

I bought it here https://item.jd.com/100012820409.html

The price is so high... The model number is the same "ZNSXJ13LM". Looks that lumi have other G3 machines in the market.

giahuy2201 commented 2 years ago

Thank for replying @niceboygithub Sorry I didn't realize it until now. Anyway, factory reset doesn't work, but I'm able to get a signal from the Tx/Rx on the board inside which I think could be useful to share

screen /dev/ttyUSB0 115200

View log 
IPL 1ab38bf 
D-11 
HW Reset 
MCP1866_4X 
miupll_400MHz 
256MB 
BIST0_0001-OK 
HS on 
Load IPL_CUST from SPINAND 

 BlSize 00006990 
CUST_KEY 
Checksum OK 
JMP+++  
IPL_CUST 1ab38bf 
_IPLCustSNandOp 
Load BL from SPINAND 
CUST Key 
KEYN_SIZE(0x0100) 
KEYN_ADDRESS(0x23c06790) 
  decomp_size=0x0006fb38 

U-Boot 2015.01 (Aug 24 2021 - 16:02:11) 

Version: I6E#g43d2959 
I2C:   ready 
DRAM:   
WARNING: Caches not enabled 
SPINAND_I:  SPINAND: _MDrv_SPINAND_GET_INFO: Found SPINAND INFO  
(0xCD) (0xEB) (0x11)  
SPINAND: board_nand_init: CIS contains part info 
256 MiB 
MMC:   MStar SD/MMC: 0 
In:    serial 
Out:   serial 
Err:   serial 
Net:   Net Initialization Skipped 
No ethernet found. 
gpio[12] is 1 
gpio[26] is 1 
gpio[23] is 1 
gpio[24] is 1 
gpio[7] is 1 
gpio[11] is 1 
gpio[9] is 1 
gpio[59] is 0 
gpio[60] is 0 
gpio[107] is 0 
gpio[108] is 0 
gpio[111] is 0 
gpio[112] is 0 
gpio[113] is 0 
gpio[114] is 0 
check key value=1 
gpio[8] is 0 
gpio[8] is 1 
gpio[6] is 0 
gpio[48] is 1 
gpio[49] is 0 
[OTP Control] operation = 2, command = 2000000, data = 0 
Results:  
0x00:: 0xff  

NAND read: device 0 offset 0xdc0000, size 0x1ab2100 
Time:6019512 us, speed:4650 KB/s 
 27992320 bytes read: OK 

NAND read: device 0 offset 0x200000, size 0x20000 
Time:29360 us, speed:4464 KB/s 
 131072 bytes read: OK 
[U-Boot] CUST Key(23c06790) 
[U-Boot] CUST AES Key(23c06790) 
[U-Boot] Image size = 27992064 bytes 
[U-Boot] RSASSA-PKCS-v1.5 done 
[U-Boot] Authenticate pass! 
[load_check_crc32_firmware:539] get actsize"0" fail, set to 0x500000! 

NAND read: device 0 offset 0x3c0000, size 0x500000 
Time:1161855 us, speed:4512 KB/s 
 5242880 bytes read: OK 

NAND read: device 0 offset 0x200000, size 0x20000 
Time:29314 us, speed:4471 KB/s 
 131072 bytes read: OK 
[U-Boot] CUST Key(23c06790) 
[U-Boot] CUST AES Key(23c06790) 
[U-Boot] Image size = 2168900 bytes 
[U-Boot] RSASSA-PKCS-v1.5 done 
[U-Boot] Authenticate pass! 
##  Booting kernel from Legacy Image at 21000000 ... 
   Image Name:   MVX4##I6E#g43d2959KL_LX409##[BR: 
   Image Type:   ARM Linux Kernel Image (lzma compressed) 
   Data Size:    2168900 Bytes = 2.1 MiB 
   Load Address: 20008000 
   Entry Point:  20008000 
   Verifying Checksum ... OK 
   Uncompressing Kernel Image ...  
[XZ] !!!reserved 0x21000000 length=0x 1000000 for xz!! 
   XZ: uncompressed size=0x44e000, ret=7 
OK 
atags:0x20000000 

Starting kernel ... 

Booting Linux on physical CPU 0x0 
Linux version 4.9.84 (huanglianshu-a1508@compilex64-ipg) (gcc version 9.1.0 (GCC) ) #43 SMP PREEMPT Tue Aug 24 17:11:16 CST 2021 
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d 
CPU: div instructions available: patching division code 
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache 
early_atags_to_fdt() success 
OF: fdt:Machine model: INFINITY6E SSC012B-S01A 
LXmem is 0xffe0000 PHYS_OFFSET is 0x20000000 
Add mem start 0x20000000 size 0xffe0000!!!! 

LX_MEM  = 0x20000000, 0xffe0000 
LX_MEM2 = 0x0, 0x0 
LX_MEM3 = 0x0, 0x0 
EMAC_LEN= 0x0 
DRAM_LEN= 0x0 
deal_with_reserve_mma_heap memblock_reserve success mma_config[0].reserved_start= 
0x27fe0000 

deal_with_reserve_mma_heap memblock_reserve success mma_config[1].reserved_start= 
0x27e7c000 

cma: Reserved 16 MiB at 0x26000000 
Memory policy: Data cache writealloc 
[infinity6e_smp_init_cpus] 
percpu: Embedded 13 pages/cpu @c7e31000 s21464 r8192 d23592 u53248 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32127 
Kernel command line: root=/dev/mtdblock8 rootfstype=squashfs ro init=/linuxrc LX_MEM=0xffe0000 mma_heap=mma_heap_name0,miu=0,sz=0x8000000 mma_heap=mma_heap_ipu,miu=0,sz=0x164000 mma_memblock_remove=1 cma=2M mtdparts=nand0:768k@1280k(IPL0),384k(IPL_CUST0),384k(IPL_CUST1),384k(UBOOT0),384k(UBOOT1),256k(ENV0),0x500000(KERNEL0),0x500000(KERNEL1),0x2000000(ROOTFS0),0x2000000(ROOTFS1),0x100000(FAC),0x4800000(RES),-(UBI) 
PID hash table entries: 512 (order: -1, 2048 bytes) 
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) 
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) 
Memory: 107116K/129520K available (2631K kernel code, 203K rwdata, 1256K rodata, 168K init, 174K bss, 6020K reserved, 16384K cma-reserved) 
Virtual kernel memory layout: 
    vector  : 0xffff0000 - 0xffff1000   (   4 kB) 
    fixmap  : 0xffc00000 - 0xfff00000   (3072 kB) 
    vmalloc : 0xc8000000 - 0xff800000   ( 888 MB) 
    lowmem  : 0xc0000000 - 0xc7e7c000   ( 126 MB) 
    modules : 0xbf800000 - 0xc0000000   (   8 MB) 
      .text : 0xc0008000 - 0xc0299ebc   (2632 kB) 
      .init : 0xc03f8000 - 0xc0422000   ( 168 kB) 
      .data : 0xc0422000 - 0xc0454ee0   ( 204 kB) 
       .bss : 0xc0456000 - 0xc0481a00   ( 175 kB) 
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 
Preemptible hierarchical RCU implementation. 
        Build-time adjustment of leaf fanout to 32. 
        RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2. 
RCU: Adjusting geometry for rcu_fanout_leaf=32, nr_cpu_ids=2 
NR_IRQS:16 nr_irqs:16 16 
ms_init_main_intc: np->name=ms_main_intc, parent=gic 
ms_init_pm_intc: np->name=ms_pm_intc, parent=ms_main_intc 
ss_init_gpi_intc: np->name=ms_gpi_intc, parent=ms_main_intc 
Find CLK_ven_pll, hook ms_venpll_ops 
Find CLK_cpupll_clk, hook ms_cpuclk_ops 
arm_arch_timer: Architected cp15 timer(s) running at 6.00MHz (virt). 
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x1623fa770, max_idle_ns: 440795202238 ns 
sched_clock: 56 bits at 6MHz, resolution 166ns, wraps every 4398046511055ns 
Switching to timer-based delay loop, resolution 166ns 
console [ttyS0] enabled 
Calibrating delay loop (skipped), value calculated using timer frequency.. 12.00 BogoMIPS (lpj=60000) 
pid_max: default: 4096 minimum: 301 
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) 
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) 
CPU: Testing write buffer coherency: ok 
CPU0: update cpu_capacity 1024 
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 
Setting up static identity map for 0x20008240 - 0x2000828c 
[infinity6e_boot_secondary] 
CPU1: update cpu_capacity 1024 
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001 
Brought up 2 CPUs 
SMP: Total of 2 processors activated (24.00 BogoMIPS). 
CPU: All CPU(s) started in SVC mode. 
devtmpfs: initialized 
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5 
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns 
futex hash table entries: 16 (order: -2, 1024 bytes) 
NET: Registered protocol family 16 
DMA: preallocated 256 KiB pool for atomic coherent allocations 

Version : MVX4##I6E#g43d2959KL_LX409##[BR:develop]#XVM 

GPIO: probe end[Padmux]reset PAD107(reg 0x103c00:8; mask0x8) t0 PWM0_MODE_1 (org: GPIO) 
[Padmux]reset PAD111(reg 0x103c00:c; mask0x8) t0 PWM4_MODE_1 (org: GPIO) 
[Padmux]reset PAD112(reg 0x103c00:d; mask0x8) t0 PWM5_MODE_1 (org: GPIO) 
[Padmux]reset PAD113(reg 0x103c00:e; mask0x8) t0 PWM6_MODE_1 (org: GPIO) 
[Padmux]reset PAD114(reg 0x103c00:f; mask0x8) t0 PWM7_MODE_1 (org: GPIO) 
[Padmux]reset PAD42(reg 0x103c00:6f; mask0x7) t0 SD1_MODE_2 (org: I2C0_MODE_1) 
hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers. 
hw-breakpoint: maximum watchpoint size is 8 bytes. 
usbcore: registered new interface driver usbfs 
usbcore: registered new interface driver hub 
usbcore: registered new device driver usb 
i2c ver3 
i2c ver3 
i2c ver3 
Advanced Linux Sound Architecture Driver Initialized. 
clocksource: Switched to clocksource arch_sys_counter 
NET: Registered protocol family 2 
TCP established hash table entries: 1024 (order: 0, 4096 bytes) 
TCP bind hash table entries: 1024 (order: 2, 20480 bytes) 
TCP: Hash tables configured (established 1024 bind 1024) 
UDP hash table entries: 128 (order: 0, 6144 bytes) 
UDP-Lite hash table entries: 128 (order: 0, 6144 bytes) 
NET: Registered protocol family 1 
hw perfevents: enabled with armv7_cortex_a7 PMU driver, 5 counters available 
workingset: timestamp_bits=30 max_order=15 bucket_order=0 
squashfs: version 4.0 (2009/01/31) Phillip Lougher 
ntfs: driver 2.1.32 [Flags: R/O]. 
io scheduler noop registered 
io scheduler deadline registered (default) 
Infinity6e PHY probe, base:fd2a4600 
libphy: Fixed MDIO Bus: probed 
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver 
Mstar_ehc_init version:20180309 
ehci monitor start running 
Sstar-ehci-1 H.W init 
Can't get power-enable-pad from DTS, set default GPIO(0) 
[Enable_USB_VBUS] Enable USB VBUS GPIO(8) 
Titania3_series_start_ehc start 
[USB] config miu select [70] [e8] [ef] [ef] 
[USB] enable miu lower bound address subtraction 
[USB] init squelch level 0x2 
[USB] no platform_data, device tree coming 
[USB][EHC] dma coherent_mask 0xffffffffffffffff mask 0xffffffffffffffff 
BC disable  
[USB] soc:Sstar-ehci-1 irq --> 69 
Sstar-ehci-1 soc:Sstar-ehci-1: EHCI Host Controller 
Sstar-ehci-1 soc:Sstar-ehci-1: new USB bus registered, assigned bus number 1 
Sstar-ehci-1 soc:Sstar-ehci-1: irq 69, io mem 0xfd284800 
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002 
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 
usb usb1: Product: EHCI Host Controller 
usb usb1: Manufacturer: Linux 4.9.84 ehci_hcd 
usb usb1: SerialNumber: mstar 
hub 1-0:1.0: USB hub found 
hub 1-0:1.0: 1 port detected 
usbcore: registered new interface driver chaoskey 
i2c /dev entries driver 
1f221000.uart0: ttyS0 at MMIO 0x0 (irq = 45, base_baud = 10800000) is a unknown 
1f221200.uart1: ttyS1 at MMIO 0x0 (irq = 47, base_baud = 10800000) is a unknown 
1f220400.uart2: ttyS2 at MMIO 0x0 (irq = 49, base_baud = 10800000) is a unknown 
[MS_PM_INTC] hw:9 -> v:72 
[MS_PM_INTC] hw:10 -> v:73 
MSYS: DMEM request: [emac0_buff]:0x00000812 
MSYS: DMEM request: [emac0_buff]:0x00000812 success, CPU phy:@0x26048000, virt:@0xC6048000 
libphy: mdio: probed 
mdio_bus mdio-bus@emac0: /soc/emac0/mdio-bus/ethernet-phy@0 has invalid PHY address 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 0 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 1 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 2 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 3 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 4 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 5 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 6 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 7 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 8 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 9 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 10 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 11 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 12 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 13 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 14 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 15 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 16 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 17 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 18 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 19 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 20 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 21 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 22 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 23 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 24 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 25 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 26 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 27 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 28 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 29 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 30 
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 31 
[emac_phy_connect][3328] connected mac emac0 to PHY at mdio-bus@emac0:00 [uid=11112222, driver=SStar 10/100 Ethernet Phy] 
ms_rtcpwc 1f006800.rtcpwc: rtc core: registered 1f006800.rtcpwc as rtc0 
MSYS: DMEM request: [AESDMA_ENG]:0x00001000 
MSYS: DMEM request: [AESDMA_ENG]:0x00001000 success, CPU phy:@0x26049000, virt:@0xC6049000 
MSYS: DMEM request: [AESDMA_ENG1]:0x00001000 
MSYS: DMEM request: [AESDMA_ENG1]:0x00001000 success, CPU phy:@0x2604A000, virt:@0xC604A000 
cryptodev: driver 1.10(a1e738a) loaded. 
random: fast init done 
random: crng init done 
[ms_cpufreq_init] Current clk=796917760 
[i6e][pwm] use ms_pwm->group_data 
[NOTICE]pwm-isr(62) success. If not i6e or i6b0, pls confirm it on .dtsi 
mstar_spinand_probe: mstar_spinand enableClock 
MSYS: DMEM request: [BDMA]:0x00000840 
MSYS: DMEM request: [BDMA]:0x00000840 success, CPU phy:@0x2604B000, virt:@0xC604B000 
MDrv_SPINAND_Init: Detected ID: MID =cd, DID =eb 
_dumpNandInformation:warning, Bytes / Page :  2048 
_dumpNandInformation:warning, Pages / Block:  64 
_dumpNandInformation:warning, Sector/ Page :  512 
_dumpNandInformation:warning, Spare / Page :  64 
_dumpNandInformation:warning, Current config r:1 w:1 drv:1 
mstar_spinand_probe: Magic memcmp pass 
mstar_spinand_probe: Get partition (Block 0 : page 1) 
mstar_spinand_probe: CIS contains part info 
mstar_spinand_probe: Before nand_scan()... 
13 cmdlinepart partitions found on MTD device nand0 
mstar_spinand_probe: Mtd parts parse 
Creating 13 MTD partitions on "nand0": 
0x000000140000-0x000000200000 : "IPL0" 
0x000000200000-0x000000260000 : "IPL_CUST0" 
0x000000260000-0x0000002c0000 : "IPL_CUST1" 
0x0000002c0000-0x000000320000 : "UBOOT0" 
0x000000320000-0x000000380000 : "UBOOT1" 
0x000000380000-0x0000003c0000 : "ENV0" 
0x0000003c0000-0x0000008c0000 : "KERNEL0" 
0x0000008c0000-0x000000dc0000 : "KERNEL1" 
0x000000dc0000-0x000002dc0000 : "ROOTFS0" 
0x000002dc0000-0x000004dc0000 : "ROOTFS1" 
0x000004dc0000-0x000004ec0000 : "FAC" 
0x000004ec0000-0x0000096c0000 : "RES" 
0x0000096c0000-0x000010000000 : "UBI" 
[emac_phy_link_adjust] EMAC Link Down  
mstar notify driver install successfully 
NET: Registered protocol family 10 
sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver 
NET: Registered protocol family 17 
[mstar_pm_init] resume_pbase=0x200114B5, suspend_imi_vbase=0xC8008000 
ThumbEE CPU extension supported. 
Registering SWP/SWPB emulation handler 
Key type encrypted registered 
ms_rtcpwc 1f006800.rtcpwc: setting system clock to 1970-01-01 00:00:17 UTC (17) 
OF: fdt:not creating '/sys/firmware/fdt': CRC check failed 
ALSA device list: 
  No soundcards found. 
VFS: Mounted root (squashfs filesystem) readonly on device 31:8. 
devtmpfs: mounted 
This architecture does not have kernel memory protection. 
1 ulimit=256 
[RCS]: /etc/init.d/S01udev 
net.core.rmem_default = 163840 
net.core.rmem_max = 163840 
net.core.wmem_default = 524288 
net.core.wmem_max = 1048576 
net.ipv4.tcp_mem = 924  1232  1848 
net.ipv4.tcp_rmem = 4096  87380  325120 
net.ipv4.tcp_wmem = 4096  131072  393216 
[RCS]: /etc/init.d/S04sstar 
>> [sdmmc_1] Err: #Cmd_52 (0x00000C00)=>(E: 0x0008)(S: 0x00000000)__(L:894) 
>> [sdmmc_1] Err: #Cmd_52 (0x80000C08)=>(E: 0x0008)(S: 0x00000000)__(L:894) 
[CSI] probe 
Request CSI IRQ[0]#30 
CSI interrupt registered 
vif driver probe 
Create device file. vif_ints,0 
jpe driver probed 
[Isp_Driver_Init] 
[s32CurClkIdx] = 0 
[ISP] Request IRQ: 29, 57 
[IspMid_Driver_Init] 
ispsclttl:0 
DivpProcInit 526 
module [sys] init 
config...... cmdpath:/config/config_tool, argv0:load_config 
config...... cmdpath:/config/config_tool, argv1:/misc/config.ini 
config...... cmdpath:/config/config_tool, argv2:/misc/PQConfig.ini 
config...... cmdpath:/config/config_tool, argv3:(null) 
module [sensor] init 
module [mipitx] init 
module [ao] init 
module [rgn] init 
module [ldc] init 
module [vpe] init 
module [shadow] init 
module [gyro] init 
module [vif] init 
module [venc] init Jan 20 2021 16:08:47 
module [panel] init 
module [disp] init 
module [ipu] init 
module [divp] init 
module [ai] init 
module [vdisp] init 
[GADGET] PULL_UP(OFF) 
[miu] [70] [ef] [ef] [ef]. 
[GADGET] UDC start 
[RCS]: /etc/init.d/S20drv 
mi_gpios_probe export led blue=48, red=49, green=6 ! 
mi_gpios_probe export ir ir_ota=12, ir_reset=26, ir_cut_daytime=24, ir_cut_night=23 ! 
mi_gpios_probe export zigbee zigbee_bootloader=7, zigbee_reset=11 ! 
mi_gpios_probe export speaker speaker_mute_gpio=9 ! 
[ss_gpi_intc_domain_alloc] hw:36 -> v:74 
[ss_gpi_intc_domain_alloc] hw:37 -> v:75 
[MS_PM_INTC] hw:2 -> v:76 
[MS_PM_INTC] hw:8 -> v:77 
[MS_PM_INTC] hw:28 -> v:78 
[MS_PM_INTC] hw:26 -> v:79 
[MS_PM_INTC] hw:25 -> v:80 
[MS_PM_INTC] hw:3 -> v:81 
[MS_PM_INTC] hw:7 -> v:82 
[MS_PM_INTC] hw:5 -> v:83 
mi_btn_probe key=10!! 
[MS_PM_INTC] hw:6 -> v:84 
mi_motor_probe export horizontal_motor blue=108, brown=107, yellow=60, black=59, vertical_motor blue=111, brown=112, yellow=113, black=114!! 
[ss_gpi_intc_domain_alloc] hw:0 -> v:85 
[ss_gpi_intc_domain_alloc] hw:1 -> v:86 
[ss_gpi_intc_domain_alloc] hw:8 -> v:87 
[ss_gpi_intc_domain_alloc] hw:9 -> v:88 
[ss_gpi_intc_domain_alloc] hw:15 -> v:89 
[ss_gpi_intc_domain_alloc] hw:14 -> v:90 
[ss_gpi_intc_domain_alloc] hw:13 -> v:91 
[ss_gpi_intc_domain_alloc] hw:12 -> v:92 
ptz ver 1 
[RCS]: /etc/init.d/S90app 
UBI device number 0, total 576 LEBs (73138176 bytes, 69.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB) 
Mount UBIFS successfully! 
ubidetach: error!: cannot detach mtd12 
           error 19 (No such device) 
UBI device number 1, total 842 LEBs (106913792 bytes, 102.0 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB) 
Mount UBIFS successfully! 
fw_manager.sh revision: 2 
pre-revision: 2 

hostname: Camera-Hub-G3-6E23 
type: lumi.camera.gwpagl01, model: CH-H02 
psvr ok,wait=1 
mDNSResponder: mDNSResponder (Engineering Build) (May 12 2021 20:55:43) starting 
mDNSResponder: mDNS_AddDNSServer: Lock not held! mDNS_busy (0) mDNS_reentrancy (0) 
mDNSResponder: mDNSPlatformSourceAddrForDest: connect 1.1.1.1 failed errno 101 (Network is unreachable) 
mDNSResponder: WARNING: mdnsd continuing as root because user "nobody" does not exist 
check mount 
store_tty0_enable buf=disable 
, count=8

It outputs whatever I type in, basically I'm not getting any shell at all. I submitted a support ticket and will update when they respond

niceboygithub commented 2 years ago

@superman110 Can you get the output of this command?

agetprop persist.app.dfu_ver
superman110 commented 2 years ago

@niceboygithub

Camera-Hub-G3-58E5 login: root 1 ulimit=256 ~ # agetprop persist.app.dfu_ver 0.0.0_0054 ~ #

niceboygithub commented 2 years ago

@niceboygithub

Camera-Hub-G3-58E5 login: root 1 ulimit=256 ~ # agetprop persist.app.dfu_ver 0.0.0_0054 ~ #

mine is "2.0.5"

Can you try to grab the firmware for your G3?

superman110 commented 2 years ago

@niceboygithub Camera-Hub-G3-58E5 login: root 1 ulimit=256 ~ # agetprop persist.app.dfu_ver 0.0.0_0054 ~ #

mine is "2.0.5"

Can you try to grab the firmware for your G3?

How to dump ROM?

hellad commented 2 years ago

I'd like to revive the theme. My recently purchased camera was hacked with telnet access. At the moment I see the following properties in agetprop command:

[ro.sys.vendor]: [Lumi United Technology Co., Ltd.]

So the factory firmware is 3.2.4_0007.0004 and I'm not able to add gateway in HA. Every attempt failed.

Is there any way to apply this integration?

P.S. In HomeKit Controller I can add the gateway

haoyixiu commented 2 years ago

你好，我出厂也是3.3.2_0001.0004固件，按照说明操作后，可以访问 telnet，但无法加到ha中。然后你给的命令升级失败，麻烦看下，谢谢

a

larrylai2 commented 1 year ago

I have installed the firmware of V3.3.4_0007.0004 successfully to my G3 (with 3.3.2_0001.0004) by the steps below. And enable telnet and connected to this AqaraCamera integration. Anyone with similar isuue can give it a try. Best Wish

I found some dicussion about how to degrade firmware to V3.3.4. As summary below, https://bbs.hassbian.com/thread-15322-2-1.html

  1. Get 'rootfs.bin' of firmware version 3.3.4. (use 7z to extract the firmware bin)
  2. Copy 'rootfs.bin' to sdcard which is using FAT32 format.
  3. Power Off G3.
  4. Insert the sdcard to G3.
  5. Press the front button of G3.
  6. Power on G3.
  7. Wait three seconds and release the button.
  8. If the LED is turned to RED, it starts to flash 'rootfs.bin'.